SonicWall patches pre-auth SSRF flaw in SMA 1000 VPNs
SonicWall has released hotfixes for four vulnerabilities in its Secure Mobile Access (SMA) 1000 series appliances. The most serious, CVE-2026-102255, can be exploited by remote attackers who have not logged in.
According to the vendor, the flaw could let an unauthenticated attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
SonicWall says it has seen no sign that any of the four bugs is being exploited. That may not last. SMA appliances, both the 1000 and the older 100 series, have been frequent targets for attackers, and similar bugs in the same product line have already been used in real attacks.